CVE-2019-25025: Observable Timing Discrepancy

March 5, 2021 (updated March 15, 2021)

The activerecord-session_store (aka Active Record Session Store) component for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

References

github.com/rails/activerecord-session_store/pull/151
nvd.nist.gov/vuln/detail/CVE-2019-25025

Code Behaviors & Features

Detect and mitigate CVE-2019-25025 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →